Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe
-
Size
887KB
-
MD5
dfcdb72099062e5d65d23b12fe9b1501
-
SHA1
e7aa9c7712619c511f439d3e61903ca077d7bf9e
-
SHA256
a2f31a27fd7dc171dca7479ff0200dfa578365a42f3da3e279bc4c89e8af19db
-
SHA512
037986cce78ce597c92464e83785b48e518aa0635f8860e7628e5a280ee59777b1a84a6aa9dd541c021859e88eee1e8a75395c17621dca136a1d13bbae4c340c
-
SSDEEP
24576:u+JbZKXJrr186amIWRVRFyIM45x6WK+WhoQXaFZOJ2jP:u+JbQsJJWRg545kWFKTgVjP
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 64 IoCs
pid Process 2596 userinit.exe 2616 system.exe 2588 system.exe 2368 system.exe 592 system.exe 956 system.exe 2148 system.exe 2996 system.exe 2628 system.exe 3028 system.exe 2960 system.exe 2276 system.exe 1420 system.exe 1296 system.exe 1500 system.exe 2548 system.exe 1880 system.exe 1056 system.exe 1000 system.exe 1352 system.exe 1712 system.exe 1624 system.exe 2120 system.exe 2100 system.exe 2068 system.exe 1428 system.exe 2888 system.exe 2712 system.exe 2840 system.exe 2632 system.exe 1244 system.exe 2312 system.exe 536 system.exe 884 system.exe 2988 system.exe 2404 system.exe 2504 system.exe 1968 system.exe 3044 system.exe 2860 system.exe 2676 system.exe 2936 system.exe 2188 system.exe 1444 system.exe 1756 system.exe 2252 system.exe 2468 system.exe 2212 system.exe 308 system.exe 864 system.exe 1904 system.exe 960 system.exe 868 system.exe 1388 system.exe 1668 system.exe 1720 system.exe 1292 system.exe 2460 system.exe 2524 system.exe 1636 system.exe 1584 system.exe 2888 system.exe 2856 system.exe 2840 system.exe -
Loads dropped DLL 64 IoCs
pid Process 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe 2596 userinit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.exe userinit.exe File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\userinit.exe dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe File opened for modification C:\Windows\userinit.exe dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe File created C:\Windows\kdcoms.dll userinit.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 2596 userinit.exe 2596 userinit.exe 2616 system.exe 2596 userinit.exe 2588 system.exe 2596 userinit.exe 2368 system.exe 2596 userinit.exe 592 system.exe 2596 userinit.exe 956 system.exe 2596 userinit.exe 2148 system.exe 2596 userinit.exe 2996 system.exe 2596 userinit.exe 2628 system.exe 2596 userinit.exe 3028 system.exe 2596 userinit.exe 2960 system.exe 2596 userinit.exe 2276 system.exe 2596 userinit.exe 1420 system.exe 2596 userinit.exe 1296 system.exe 2596 userinit.exe 1500 system.exe 2596 userinit.exe 2548 system.exe 2596 userinit.exe 1880 system.exe 2596 userinit.exe 1056 system.exe 2596 userinit.exe 1000 system.exe 2596 userinit.exe 1352 system.exe 2596 userinit.exe 1712 system.exe 2596 userinit.exe 1624 system.exe 2596 userinit.exe 2120 system.exe 2596 userinit.exe 2100 system.exe 2596 userinit.exe 2068 system.exe 2596 userinit.exe 1428 system.exe 2596 userinit.exe 2888 system.exe 2596 userinit.exe 2712 system.exe 2596 userinit.exe 2840 system.exe 2596 userinit.exe 2632 system.exe 2596 userinit.exe 1244 system.exe 2596 userinit.exe 2312 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 userinit.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 2596 userinit.exe 2596 userinit.exe 2616 system.exe 2616 system.exe 2588 system.exe 2588 system.exe 2368 system.exe 2368 system.exe 592 system.exe 592 system.exe 956 system.exe 956 system.exe 2148 system.exe 2148 system.exe 2996 system.exe 2996 system.exe 2628 system.exe 2628 system.exe 3028 system.exe 3028 system.exe 2960 system.exe 2960 system.exe 2276 system.exe 2276 system.exe 1420 system.exe 1420 system.exe 1296 system.exe 1296 system.exe 1500 system.exe 1500 system.exe 2548 system.exe 2548 system.exe 1880 system.exe 1880 system.exe 1056 system.exe 1056 system.exe 1000 system.exe 1000 system.exe 1352 system.exe 1352 system.exe 1712 system.exe 1712 system.exe 1624 system.exe 1624 system.exe 2120 system.exe 2120 system.exe 2100 system.exe 2100 system.exe 2068 system.exe 2068 system.exe 1428 system.exe 1428 system.exe 2888 system.exe 2888 system.exe 2712 system.exe 2712 system.exe 2840 system.exe 2840 system.exe 2632 system.exe 2632 system.exe 1244 system.exe 1244 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2596 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 30 PID 2828 wrote to memory of 2596 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 30 PID 2828 wrote to memory of 2596 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 30 PID 2828 wrote to memory of 2596 2828 dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe 30 PID 2596 wrote to memory of 2616 2596 userinit.exe 31 PID 2596 wrote to memory of 2616 2596 userinit.exe 31 PID 2596 wrote to memory of 2616 2596 userinit.exe 31 PID 2596 wrote to memory of 2616 2596 userinit.exe 31 PID 2596 wrote to memory of 2588 2596 userinit.exe 32 PID 2596 wrote to memory of 2588 2596 userinit.exe 32 PID 2596 wrote to memory of 2588 2596 userinit.exe 32 PID 2596 wrote to memory of 2588 2596 userinit.exe 32 PID 2596 wrote to memory of 2368 2596 userinit.exe 33 PID 2596 wrote to memory of 2368 2596 userinit.exe 33 PID 2596 wrote to memory of 2368 2596 userinit.exe 33 PID 2596 wrote to memory of 2368 2596 userinit.exe 33 PID 2596 wrote to memory of 592 2596 userinit.exe 34 PID 2596 wrote to memory of 592 2596 userinit.exe 34 PID 2596 wrote to memory of 592 2596 userinit.exe 34 PID 2596 wrote to memory of 592 2596 userinit.exe 34 PID 2596 wrote to memory of 956 2596 userinit.exe 35 PID 2596 wrote to memory of 956 2596 userinit.exe 35 PID 2596 wrote to memory of 956 2596 userinit.exe 35 PID 2596 wrote to memory of 956 2596 userinit.exe 35 PID 2596 wrote to memory of 2148 2596 userinit.exe 36 PID 2596 wrote to memory of 2148 2596 userinit.exe 36 PID 2596 wrote to memory of 2148 2596 userinit.exe 36 PID 2596 wrote to memory of 2148 2596 userinit.exe 36 PID 2596 wrote to memory of 2996 2596 userinit.exe 37 PID 2596 wrote to memory of 2996 2596 userinit.exe 37 PID 2596 wrote to memory of 2996 2596 userinit.exe 37 PID 2596 wrote to memory of 2996 2596 userinit.exe 37 PID 2596 wrote to memory of 2628 2596 userinit.exe 38 PID 2596 wrote to memory of 2628 2596 userinit.exe 38 PID 2596 wrote to memory of 2628 2596 userinit.exe 38 PID 2596 wrote to memory of 2628 2596 userinit.exe 38 PID 2596 wrote to memory of 3028 2596 userinit.exe 39 PID 2596 wrote to memory of 3028 2596 userinit.exe 39 PID 2596 wrote to memory of 3028 2596 userinit.exe 39 PID 2596 wrote to memory of 3028 2596 userinit.exe 39 PID 2596 wrote to memory of 2960 2596 userinit.exe 40 PID 2596 wrote to memory of 2960 2596 userinit.exe 40 PID 2596 wrote to memory of 2960 2596 userinit.exe 40 PID 2596 wrote to memory of 2960 2596 userinit.exe 40 PID 2596 wrote to memory of 2276 2596 userinit.exe 41 PID 2596 wrote to memory of 2276 2596 userinit.exe 41 PID 2596 wrote to memory of 2276 2596 userinit.exe 41 PID 2596 wrote to memory of 2276 2596 userinit.exe 41 PID 2596 wrote to memory of 1420 2596 userinit.exe 42 PID 2596 wrote to memory of 1420 2596 userinit.exe 42 PID 2596 wrote to memory of 1420 2596 userinit.exe 42 PID 2596 wrote to memory of 1420 2596 userinit.exe 42 PID 2596 wrote to memory of 1296 2596 userinit.exe 43 PID 2596 wrote to memory of 1296 2596 userinit.exe 43 PID 2596 wrote to memory of 1296 2596 userinit.exe 43 PID 2596 wrote to memory of 1296 2596 userinit.exe 43 PID 2596 wrote to memory of 1500 2596 userinit.exe 44 PID 2596 wrote to memory of 1500 2596 userinit.exe 44 PID 2596 wrote to memory of 1500 2596 userinit.exe 44 PID 2596 wrote to memory of 1500 2596 userinit.exe 44 PID 2596 wrote to memory of 2548 2596 userinit.exe 45 PID 2596 wrote to memory of 2548 2596 userinit.exe 45 PID 2596 wrote to memory of 2548 2596 userinit.exe 45 PID 2596 wrote to memory of 2548 2596 userinit.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dfcdb72099062e5d65d23b12fe9b1501_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\userinit.exeC:\Windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2996
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1420
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1296
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2548
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1056
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2100
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1428
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1244
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2988
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2504
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1968
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3044
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2188
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1444
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2252
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2212
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:308
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:868
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1668
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1292
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2460
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2524
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1636
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1584
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2840
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2256
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2916
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:996
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2148
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2540
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2532
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2952
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2956
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2860
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2940
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2188
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1420
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2008
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:768
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1940
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1364
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1552
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1324
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2144
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1352
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:928
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1312
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2100
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1776
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2740
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2220
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2836
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2632
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2652
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1920
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:476
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1048
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2088
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2084
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2572
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2932
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:400
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2984
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3044
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2772
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2768
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1156
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1612
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2060
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1508
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1108
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:444
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1904
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:940
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1324
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1808
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1716
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2120
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2072
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2524
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1636
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2476
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2412
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:836
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2700
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
887KB
MD5dfcdb72099062e5d65d23b12fe9b1501
SHA1e7aa9c7712619c511f439d3e61903ca077d7bf9e
SHA256a2f31a27fd7dc171dca7479ff0200dfa578365a42f3da3e279bc4c89e8af19db
SHA512037986cce78ce597c92464e83785b48e518aa0635f8860e7628e5a280ee59777b1a84a6aa9dd541c021859e88eee1e8a75395c17621dca136a1d13bbae4c340c