Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe
-
Size
388KB
-
MD5
e9d241d83d6df24d69f9c72fad13cc9f
-
SHA1
2607b9d33f9c1425b2b0480c0f9c4e591f6ad5e7
-
SHA256
3313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97
-
SHA512
ce234473ce0071e205c32d8b5cc97b6607a7cbe9d54bddb4b1a131ce63878145b3b3ae97f33bfab28c56307d8ad9f4ac772616e1ba5fe6a468578d148335ef10
-
SSDEEP
1536:Tkf1zwQVg/8WuREUlOQnF7TkkYSDY6ep5f1zwQVgvXg6Y+:Y1zwL/8WuREcnFEkYSYpJ1zwLvX
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 64 IoCs
pid Process 2796 userinit.exe 2648 system.exe 2072 system.exe 2528 system.exe 2140 system.exe 1060 system.exe 2384 system.exe 1260 system.exe 1704 system.exe 2420 system.exe 2880 system.exe 2768 system.exe 2036 system.exe 2316 system.exe 2340 system.exe 2184 system.exe 2064 system.exe 792 system.exe 716 system.exe 3008 system.exe 2724 system.exe 604 system.exe 1316 system.exe 1644 system.exe 1012 system.exe 1440 system.exe 1504 system.exe 2676 system.exe 2744 system.exe 2636 system.exe 2692 system.exe 2648 system.exe 2668 system.exe 3040 system.exe 1996 system.exe 2920 system.exe 2628 system.exe 2376 system.exe 2888 system.exe 1720 system.exe 788 system.exe 2240 system.exe 808 system.exe 292 system.exe 1904 system.exe 2036 system.exe 2316 system.exe 836 system.exe 1160 system.exe 1100 system.exe 1736 system.exe 924 system.exe 1648 system.exe 1508 system.exe 2396 system.exe 1768 system.exe 2304 system.exe 1632 system.exe 696 system.exe 1396 system.exe 2004 system.exe 1848 system.exe 2752 system.exe 2804 system.exe -
Loads dropped DLL 64 IoCs
pid Process 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe 2796 userinit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe File created C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\kdcoms.dll userinit.exe File created C:\Windows\userinit.exe e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe File opened for modification C:\Windows\userinit.exe e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 2796 userinit.exe 2796 userinit.exe 2648 system.exe 2796 userinit.exe 2072 system.exe 2796 userinit.exe 2528 system.exe 2796 userinit.exe 2140 system.exe 2796 userinit.exe 1060 system.exe 2796 userinit.exe 2384 system.exe 2796 userinit.exe 1260 system.exe 2796 userinit.exe 1704 system.exe 2796 userinit.exe 2420 system.exe 2796 userinit.exe 2880 system.exe 2796 userinit.exe 2768 system.exe 2796 userinit.exe 2036 system.exe 2796 userinit.exe 2316 system.exe 2796 userinit.exe 2340 system.exe 2796 userinit.exe 2184 system.exe 2796 userinit.exe 2064 system.exe 2796 userinit.exe 792 system.exe 2796 userinit.exe 716 system.exe 2796 userinit.exe 3008 system.exe 2796 userinit.exe 2724 system.exe 2796 userinit.exe 604 system.exe 2796 userinit.exe 1316 system.exe 2796 userinit.exe 1644 system.exe 2796 userinit.exe 1012 system.exe 2796 userinit.exe 1440 system.exe 2796 userinit.exe 1504 system.exe 2796 userinit.exe 2676 system.exe 2796 userinit.exe 2744 system.exe 2796 userinit.exe 2636 system.exe 2796 userinit.exe 2692 system.exe 2796 userinit.exe 2648 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2796 userinit.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 2796 userinit.exe 2796 userinit.exe 2648 system.exe 2648 system.exe 2072 system.exe 2072 system.exe 2528 system.exe 2528 system.exe 2140 system.exe 2140 system.exe 1060 system.exe 1060 system.exe 2384 system.exe 2384 system.exe 1260 system.exe 1260 system.exe 1704 system.exe 1704 system.exe 2420 system.exe 2420 system.exe 2880 system.exe 2880 system.exe 2768 system.exe 2768 system.exe 2036 system.exe 2036 system.exe 2316 system.exe 2316 system.exe 2340 system.exe 2340 system.exe 2184 system.exe 2184 system.exe 2064 system.exe 2064 system.exe 792 system.exe 792 system.exe 716 system.exe 716 system.exe 3008 system.exe 3008 system.exe 2724 system.exe 2724 system.exe 604 system.exe 604 system.exe 1316 system.exe 1316 system.exe 1644 system.exe 1644 system.exe 1012 system.exe 1012 system.exe 1440 system.exe 1440 system.exe 1504 system.exe 1504 system.exe 2676 system.exe 2676 system.exe 2744 system.exe 2744 system.exe 2636 system.exe 2636 system.exe 2692 system.exe 2692 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2796 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2796 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2796 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2796 2636 e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe 30 PID 2796 wrote to memory of 2648 2796 userinit.exe 31 PID 2796 wrote to memory of 2648 2796 userinit.exe 31 PID 2796 wrote to memory of 2648 2796 userinit.exe 31 PID 2796 wrote to memory of 2648 2796 userinit.exe 31 PID 2796 wrote to memory of 2072 2796 userinit.exe 32 PID 2796 wrote to memory of 2072 2796 userinit.exe 32 PID 2796 wrote to memory of 2072 2796 userinit.exe 32 PID 2796 wrote to memory of 2072 2796 userinit.exe 32 PID 2796 wrote to memory of 2528 2796 userinit.exe 33 PID 2796 wrote to memory of 2528 2796 userinit.exe 33 PID 2796 wrote to memory of 2528 2796 userinit.exe 33 PID 2796 wrote to memory of 2528 2796 userinit.exe 33 PID 2796 wrote to memory of 2140 2796 userinit.exe 34 PID 2796 wrote to memory of 2140 2796 userinit.exe 34 PID 2796 wrote to memory of 2140 2796 userinit.exe 34 PID 2796 wrote to memory of 2140 2796 userinit.exe 34 PID 2796 wrote to memory of 1060 2796 userinit.exe 35 PID 2796 wrote to memory of 1060 2796 userinit.exe 35 PID 2796 wrote to memory of 1060 2796 userinit.exe 35 PID 2796 wrote to memory of 1060 2796 userinit.exe 35 PID 2796 wrote to memory of 2384 2796 userinit.exe 36 PID 2796 wrote to memory of 2384 2796 userinit.exe 36 PID 2796 wrote to memory of 2384 2796 userinit.exe 36 PID 2796 wrote to memory of 2384 2796 userinit.exe 36 PID 2796 wrote to memory of 1260 2796 userinit.exe 37 PID 2796 wrote to memory of 1260 2796 userinit.exe 37 PID 2796 wrote to memory of 1260 2796 userinit.exe 37 PID 2796 wrote to memory of 1260 2796 userinit.exe 37 PID 2796 wrote to memory of 1704 2796 userinit.exe 38 PID 2796 wrote to memory of 1704 2796 userinit.exe 38 PID 2796 wrote to memory of 1704 2796 userinit.exe 38 PID 2796 wrote to memory of 1704 2796 userinit.exe 38 PID 2796 wrote to memory of 2420 2796 userinit.exe 39 PID 2796 wrote to memory of 2420 2796 userinit.exe 39 PID 2796 wrote to memory of 2420 2796 userinit.exe 39 PID 2796 wrote to memory of 2420 2796 userinit.exe 39 PID 2796 wrote to memory of 2880 2796 userinit.exe 40 PID 2796 wrote to memory of 2880 2796 userinit.exe 40 PID 2796 wrote to memory of 2880 2796 userinit.exe 40 PID 2796 wrote to memory of 2880 2796 userinit.exe 40 PID 2796 wrote to memory of 2768 2796 userinit.exe 41 PID 2796 wrote to memory of 2768 2796 userinit.exe 41 PID 2796 wrote to memory of 2768 2796 userinit.exe 41 PID 2796 wrote to memory of 2768 2796 userinit.exe 41 PID 2796 wrote to memory of 2036 2796 userinit.exe 42 PID 2796 wrote to memory of 2036 2796 userinit.exe 42 PID 2796 wrote to memory of 2036 2796 userinit.exe 42 PID 2796 wrote to memory of 2036 2796 userinit.exe 42 PID 2796 wrote to memory of 2316 2796 userinit.exe 43 PID 2796 wrote to memory of 2316 2796 userinit.exe 43 PID 2796 wrote to memory of 2316 2796 userinit.exe 43 PID 2796 wrote to memory of 2316 2796 userinit.exe 43 PID 2796 wrote to memory of 2340 2796 userinit.exe 44 PID 2796 wrote to memory of 2340 2796 userinit.exe 44 PID 2796 wrote to memory of 2340 2796 userinit.exe 44 PID 2796 wrote to memory of 2340 2796 userinit.exe 44 PID 2796 wrote to memory of 2184 2796 userinit.exe 45 PID 2796 wrote to memory of 2184 2796 userinit.exe 45 PID 2796 wrote to memory of 2184 2796 userinit.exe 45 PID 2796 wrote to memory of 2184 2796 userinit.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\userinit.exeC:\Windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2528
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2140
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2420
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2316
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2184
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:792
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:716
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:604
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2668
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3040
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2376
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:788
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:808
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:292
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1904
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2036
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:836
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1160
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1508
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2304
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1632
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1396
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2004
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1848
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2752
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2804
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2808
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2812
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3044
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2912
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1260
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2424
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2916
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1332
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2192
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1952
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2476
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2320
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2176
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2088
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:852
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1288
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2432
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1324
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2032
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2256
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2724
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2304
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3036
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2364
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:700
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3060
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2640
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2080
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2636
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2580
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2872
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3048
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3052
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2940
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1260
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:600
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1544
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:776
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1072
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:320
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1936
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1524
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:836
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1292
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1748
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1312
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1740
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:588
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1536
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2856
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1788
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1512
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2392
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:796
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2412
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1048
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1956
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1604
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2444
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2732
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2812
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388KB
MD5e9d241d83d6df24d69f9c72fad13cc9f
SHA12607b9d33f9c1425b2b0480c0f9c4e591f6ad5e7
SHA2563313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97
SHA512ce234473ce0071e205c32d8b5cc97b6607a7cbe9d54bddb4b1a131ce63878145b3b3ae97f33bfab28c56307d8ad9f4ac772616e1ba5fe6a468578d148335ef10