Analysis
-
max time kernel
42s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 02:21
Behavioral task
behavioral1
Sample
f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe
-
Size
341KB
-
MD5
f117d1405dc44218e7c22f108a5d8b2e
-
SHA1
337625f7878c3867366d969c652ce47b05470a49
-
SHA256
b7398f2e2567e70dc8649595f30b93697c9d2561c247b3f648193fbb31c22e93
-
SHA512
9003c8ff1d9d852b13959e805a8b487570ec3b1cee83412a5a4474586499cdd6cb54eb79232bf29a4bd1b7c0a930036ebf65be918299238f367c36d52d2999b9
-
SSDEEP
6144:zwROOloJ7dZGPGVNN6dEf0/wogNUHlyDUOp5uRxeytb:MR3loBFV2IS7gNT/MJt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2756-18-0x0000000000400000-0x000000000045D000-memory.dmp modiloader_stage2 -
Executes dropped EXE 64 IoCs
pid Process 2776 mm.scr 2524 mm.scr 2388 mm.scr 580 mm.scr 572 mm.scr 556 mm.scr 1756 mm.scr 2860 mm.scr 2824 mm.scr 2872 mm.scr 3052 mm.scr 1232 mm.scr 2004 mm.scr 2412 mm.scr 2992 mm.scr 1420 mm.scr 1972 mm.scr 2356 mm.scr 852 mm.scr 948 mm.scr 1276 mm.scr 1652 mm.scr 2492 mm.scr 1004 mm.scr 908 mm.scr 2380 mm.scr 2536 mm.scr 2404 mm.scr 2764 mm.scr 2068 mm.scr 2800 mm.scr 2144 mm.scr 624 mm.scr 2072 mm.scr 264 mm.scr 3020 mm.scr 2572 mm.scr 2752 mm.scr 276 mm.scr 2824 mm.scr 1860 mm.scr 2228 mm.scr 2860 mm.scr 2344 mm.scr 2296 mm.scr 904 mm.scr 3040 mm.scr 2564 mm.scr 2256 mm.scr 2992 mm.scr 2684 mm.scr 2924 mm.scr 2468 mm.scr 2808 mm.scr 272 mm.scr 1468 mm.scr 948 mm.scr 2780 mm.scr 3024 mm.scr 1432 mm.scr 2268 mm.scr 2004 mm.scr 1940 mm.scr 2928 mm.scr -
Loads dropped DLL 2 IoCs
pid Process 2756 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 2756 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2776 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2524 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 2388 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 580 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 572 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr 556 mm.scr -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2776 mm.scr Token: SeDebugPrivilege 2524 mm.scr Token: SeDebugPrivilege 2388 mm.scr Token: SeDebugPrivilege 580 mm.scr Token: SeDebugPrivilege 572 mm.scr Token: SeDebugPrivilege 556 mm.scr Token: SeDebugPrivilege 1756 mm.scr Token: SeDebugPrivilege 2860 mm.scr Token: SeDebugPrivilege 2824 mm.scr Token: SeDebugPrivilege 2872 mm.scr Token: SeDebugPrivilege 3052 mm.scr Token: SeDebugPrivilege 1232 mm.scr Token: SeDebugPrivilege 2004 mm.scr Token: SeDebugPrivilege 2412 mm.scr Token: SeDebugPrivilege 2992 mm.scr Token: SeDebugPrivilege 1420 mm.scr Token: SeDebugPrivilege 1972 mm.scr Token: SeDebugPrivilege 2356 mm.scr Token: SeDebugPrivilege 852 mm.scr Token: SeDebugPrivilege 948 mm.scr Token: SeDebugPrivilege 1276 mm.scr Token: SeDebugPrivilege 1652 mm.scr Token: SeDebugPrivilege 2492 mm.scr Token: SeDebugPrivilege 1004 mm.scr Token: SeDebugPrivilege 908 mm.scr Token: SeDebugPrivilege 2380 mm.scr Token: SeDebugPrivilege 2536 mm.scr Token: SeDebugPrivilege 2404 mm.scr Token: SeDebugPrivilege 2764 mm.scr Token: SeDebugPrivilege 2068 mm.scr Token: SeDebugPrivilege 2800 mm.scr Token: SeDebugPrivilege 2144 mm.scr Token: SeDebugPrivilege 624 mm.scr Token: SeDebugPrivilege 2072 mm.scr Token: SeDebugPrivilege 264 mm.scr Token: SeDebugPrivilege 3020 mm.scr Token: SeDebugPrivilege 2572 mm.scr Token: SeDebugPrivilege 2752 mm.scr Token: SeDebugPrivilege 276 mm.scr Token: SeDebugPrivilege 2824 mm.scr Token: SeDebugPrivilege 1860 mm.scr Token: SeDebugPrivilege 2228 mm.scr Token: SeDebugPrivilege 2860 mm.scr Token: SeDebugPrivilege 2344 mm.scr Token: SeDebugPrivilege 2296 mm.scr Token: SeDebugPrivilege 904 mm.scr Token: SeDebugPrivilege 3040 mm.scr Token: SeDebugPrivilege 2564 mm.scr Token: SeDebugPrivilege 2256 mm.scr Token: SeDebugPrivilege 2992 mm.scr Token: SeDebugPrivilege 2684 mm.scr Token: SeDebugPrivilege 2924 mm.scr Token: SeDebugPrivilege 2468 mm.scr Token: SeDebugPrivilege 2808 mm.scr Token: SeDebugPrivilege 272 mm.scr Token: SeDebugPrivilege 1468 mm.scr Token: SeDebugPrivilege 948 mm.scr Token: SeDebugPrivilege 2780 mm.scr Token: SeDebugPrivilege 3024 mm.scr Token: SeDebugPrivilege 1432 mm.scr Token: SeDebugPrivilege 2268 mm.scr Token: SeDebugPrivilege 2004 mm.scr Token: SeDebugPrivilege 1940 mm.scr Token: SeDebugPrivilege 2928 mm.scr -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2556 DllHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2776 2756 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 30 PID 2756 wrote to memory of 2776 2756 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 30 PID 2756 wrote to memory of 2776 2756 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 30 PID 2756 wrote to memory of 2776 2756 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 30 PID 2776 wrote to memory of 2524 2776 mm.scr 32 PID 2776 wrote to memory of 2524 2776 mm.scr 32 PID 2776 wrote to memory of 2524 2776 mm.scr 32 PID 2524 wrote to memory of 2388 2524 mm.scr 33 PID 2524 wrote to memory of 2388 2524 mm.scr 33 PID 2524 wrote to memory of 2388 2524 mm.scr 33 PID 2388 wrote to memory of 580 2388 mm.scr 34 PID 2388 wrote to memory of 580 2388 mm.scr 34 PID 2388 wrote to memory of 580 2388 mm.scr 34 PID 580 wrote to memory of 572 580 mm.scr 35 PID 580 wrote to memory of 572 580 mm.scr 35 PID 580 wrote to memory of 572 580 mm.scr 35 PID 572 wrote to memory of 556 572 mm.scr 37 PID 572 wrote to memory of 556 572 mm.scr 37 PID 572 wrote to memory of 556 572 mm.scr 37 PID 556 wrote to memory of 1756 556 mm.scr 38 PID 556 wrote to memory of 1756 556 mm.scr 38 PID 556 wrote to memory of 1756 556 mm.scr 38 PID 1756 wrote to memory of 2860 1756 mm.scr 39 PID 1756 wrote to memory of 2860 1756 mm.scr 39 PID 1756 wrote to memory of 2860 1756 mm.scr 39 PID 2860 wrote to memory of 2824 2860 mm.scr 40 PID 2860 wrote to memory of 2824 2860 mm.scr 40 PID 2860 wrote to memory of 2824 2860 mm.scr 40 PID 2824 wrote to memory of 2872 2824 mm.scr 41 PID 2824 wrote to memory of 2872 2824 mm.scr 41 PID 2824 wrote to memory of 2872 2824 mm.scr 41 PID 2872 wrote to memory of 3052 2872 mm.scr 42 PID 2872 wrote to memory of 3052 2872 mm.scr 42 PID 2872 wrote to memory of 3052 2872 mm.scr 42 PID 3052 wrote to memory of 1232 3052 mm.scr 43 PID 3052 wrote to memory of 1232 3052 mm.scr 43 PID 3052 wrote to memory of 1232 3052 mm.scr 43 PID 1232 wrote to memory of 2004 1232 mm.scr 44 PID 1232 wrote to memory of 2004 1232 mm.scr 44 PID 1232 wrote to memory of 2004 1232 mm.scr 44 PID 2004 wrote to memory of 2412 2004 mm.scr 45 PID 2004 wrote to memory of 2412 2004 mm.scr 45 PID 2004 wrote to memory of 2412 2004 mm.scr 45 PID 2412 wrote to memory of 2992 2412 mm.scr 81 PID 2412 wrote to memory of 2992 2412 mm.scr 81 PID 2412 wrote to memory of 2992 2412 mm.scr 81 PID 2992 wrote to memory of 1420 2992 mm.scr 47 PID 2992 wrote to memory of 1420 2992 mm.scr 47 PID 2992 wrote to memory of 1420 2992 mm.scr 47 PID 1420 wrote to memory of 1972 1420 mm.scr 48 PID 1420 wrote to memory of 1972 1420 mm.scr 48 PID 1420 wrote to memory of 1972 1420 mm.scr 48 PID 1972 wrote to memory of 2356 1972 mm.scr 49 PID 1972 wrote to memory of 2356 1972 mm.scr 49 PID 1972 wrote to memory of 2356 1972 mm.scr 49 PID 2356 wrote to memory of 852 2356 mm.scr 50 PID 2356 wrote to memory of 852 2356 mm.scr 50 PID 2356 wrote to memory of 852 2356 mm.scr 50 PID 852 wrote to memory of 948 852 mm.scr 88 PID 852 wrote to memory of 948 852 mm.scr 88 PID 852 wrote to memory of 948 852 mm.scr 88 PID 948 wrote to memory of 1276 948 mm.scr 52 PID 948 wrote to memory of 1276 948 mm.scr 52 PID 948 wrote to memory of 1276 948 mm.scr 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\mm.scr"C:\Users\Admin\AppData\Local\Temp\mm.scr" /S2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:264 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:276 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:272 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr66⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr67⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr68⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr69⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr70⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr71⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr72⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr73⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr74⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr75⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr76⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr77⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr78⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr79⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr80⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr81⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr82⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr83⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr84⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr85⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr86⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr87⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr88⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr89⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr90⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr91⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr92⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr93⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr94⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr95⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr96⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr97⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr98⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr99⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr100⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr101⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr102⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr103⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr104⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr105⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr106⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr107⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr108⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr109⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr110⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr111⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr112⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr113⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr114⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr115⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr116⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr117⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr118⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr119⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr120⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr121⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr122⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-