Analysis
-
max time kernel
42s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2024 02:21
Behavioral task
behavioral1
Sample
f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe
-
Size
341KB
-
MD5
f117d1405dc44218e7c22f108a5d8b2e
-
SHA1
337625f7878c3867366d969c652ce47b05470a49
-
SHA256
b7398f2e2567e70dc8649595f30b93697c9d2561c247b3f648193fbb31c22e93
-
SHA512
9003c8ff1d9d852b13959e805a8b487570ec3b1cee83412a5a4474586499cdd6cb54eb79232bf29a4bd1b7c0a930036ebf65be918299238f367c36d52d2999b9
-
SSDEEP
6144:zwROOloJ7dZGPGVNN6dEf0/wogNUHlyDUOp5uRxeytb:MR3loBFV2IS7gNT/MJt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/2208-6-0x0000000000400000-0x000000000045D000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1856 mm.scr 2424 mm.scr 4964 mm.scr 4936 mm.scr 3760 mm.scr 1900 mm.scr 408 mm.scr 1712 mm.scr 1596 mm.scr 1076 mm.scr 2396 mm.scr 1748 mm.scr 1064 mm.scr 376 mm.scr 3176 mm.scr 32 mm.scr 4680 mm.scr 4628 mm.scr 3572 mm.scr 3144 mm.scr 4792 mm.scr 4488 mm.scr 936 mm.scr 2292 mm.scr 3436 mm.scr 3848 mm.scr 1088 mm.scr 3484 mm.scr 4300 mm.scr 4696 mm.scr 1504 mm.scr 468 mm.scr 4432 mm.scr 3272 mm.scr 4304 mm.scr 4252 mm.scr 2136 mm.scr 2360 mm.scr 4356 mm.scr 1156 mm.scr 4464 mm.scr 2296 mm.scr 1856 mm.scr 3036 mm.scr 4040 mm.scr 836 mm.scr 4500 mm.scr 4840 mm.scr 408 mm.scr 3120 mm.scr 736 mm.scr 4956 mm.scr 4404 mm.scr 5084 mm.scr 1264 mm.scr 3224 mm.scr 1452 mm.scr 1964 mm.scr 2880 mm.scr 3572 mm.scr 916 mm.scr 4596 mm.scr 1600 mm.scr 696 mm.scr -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini mm.scr File opened for modification C:\Windows\assembly\Desktop.ini mm.scr -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini mm.scr File opened for modification C:\Windows\assembly\Desktop.ini mm.scr File opened for modification C:\Windows\assembly mm.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 1856 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 2424 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4964 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 4936 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 3760 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr 1900 mm.scr -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1856 mm.scr Token: SeDebugPrivilege 2424 mm.scr Token: SeDebugPrivilege 4964 mm.scr Token: SeDebugPrivilege 4936 mm.scr Token: SeDebugPrivilege 3760 mm.scr Token: SeDebugPrivilege 1900 mm.scr Token: SeDebugPrivilege 408 mm.scr Token: SeDebugPrivilege 1712 mm.scr Token: SeDebugPrivilege 1596 mm.scr Token: SeDebugPrivilege 1076 mm.scr Token: SeDebugPrivilege 2396 mm.scr Token: SeDebugPrivilege 1748 mm.scr Token: SeDebugPrivilege 1064 mm.scr Token: SeDebugPrivilege 376 mm.scr Token: SeDebugPrivilege 3176 mm.scr Token: SeDebugPrivilege 32 mm.scr Token: SeDebugPrivilege 4680 mm.scr Token: SeDebugPrivilege 4628 mm.scr Token: SeDebugPrivilege 3572 mm.scr Token: SeDebugPrivilege 3144 mm.scr Token: SeDebugPrivilege 4792 mm.scr Token: SeDebugPrivilege 4488 mm.scr Token: SeDebugPrivilege 936 mm.scr Token: SeDebugPrivilege 2292 mm.scr Token: SeDebugPrivilege 3436 mm.scr Token: SeDebugPrivilege 3848 mm.scr Token: SeDebugPrivilege 1088 mm.scr Token: SeDebugPrivilege 3484 mm.scr Token: SeDebugPrivilege 4300 mm.scr Token: SeDebugPrivilege 4696 mm.scr Token: SeDebugPrivilege 1504 mm.scr Token: SeDebugPrivilege 468 mm.scr Token: SeDebugPrivilege 4432 mm.scr Token: SeDebugPrivilege 3272 mm.scr Token: SeDebugPrivilege 4304 mm.scr Token: SeDebugPrivilege 4252 mm.scr Token: SeDebugPrivilege 2136 mm.scr Token: SeDebugPrivilege 2360 mm.scr Token: SeDebugPrivilege 4356 mm.scr Token: SeDebugPrivilege 1156 mm.scr Token: SeDebugPrivilege 4464 mm.scr Token: SeDebugPrivilege 2296 mm.scr Token: SeDebugPrivilege 1856 mm.scr Token: SeDebugPrivilege 3036 mm.scr Token: SeDebugPrivilege 4040 mm.scr Token: SeDebugPrivilege 836 mm.scr Token: SeDebugPrivilege 4500 mm.scr Token: SeDebugPrivilege 4840 mm.scr Token: SeDebugPrivilege 408 mm.scr Token: SeDebugPrivilege 3120 mm.scr Token: SeDebugPrivilege 736 mm.scr Token: SeDebugPrivilege 4956 mm.scr Token: SeDebugPrivilege 4404 mm.scr Token: SeDebugPrivilege 5084 mm.scr Token: SeDebugPrivilege 1264 mm.scr Token: SeDebugPrivilege 3224 mm.scr Token: SeDebugPrivilege 1452 mm.scr Token: SeDebugPrivilege 1964 mm.scr Token: SeDebugPrivilege 2880 mm.scr Token: SeDebugPrivilege 3572 mm.scr Token: SeDebugPrivilege 916 mm.scr Token: SeDebugPrivilege 4596 mm.scr Token: SeDebugPrivilege 1600 mm.scr Token: SeDebugPrivilege 696 mm.scr -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1856 2208 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 84 PID 2208 wrote to memory of 1856 2208 f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe 84 PID 1856 wrote to memory of 2424 1856 mm.scr 85 PID 1856 wrote to memory of 2424 1856 mm.scr 85 PID 2424 wrote to memory of 4964 2424 mm.scr 86 PID 2424 wrote to memory of 4964 2424 mm.scr 86 PID 4964 wrote to memory of 4936 4964 mm.scr 87 PID 4964 wrote to memory of 4936 4964 mm.scr 87 PID 4936 wrote to memory of 3760 4936 mm.scr 89 PID 4936 wrote to memory of 3760 4936 mm.scr 89 PID 3760 wrote to memory of 1900 3760 mm.scr 90 PID 3760 wrote to memory of 1900 3760 mm.scr 90 PID 1900 wrote to memory of 408 1900 mm.scr 91 PID 1900 wrote to memory of 408 1900 mm.scr 91 PID 408 wrote to memory of 1712 408 mm.scr 92 PID 408 wrote to memory of 1712 408 mm.scr 92 PID 1712 wrote to memory of 1596 1712 mm.scr 93 PID 1712 wrote to memory of 1596 1712 mm.scr 93 PID 1596 wrote to memory of 1076 1596 mm.scr 94 PID 1596 wrote to memory of 1076 1596 mm.scr 94 PID 1076 wrote to memory of 2396 1076 mm.scr 95 PID 1076 wrote to memory of 2396 1076 mm.scr 95 PID 2396 wrote to memory of 1748 2396 mm.scr 96 PID 2396 wrote to memory of 1748 2396 mm.scr 96 PID 1748 wrote to memory of 1064 1748 mm.scr 97 PID 1748 wrote to memory of 1064 1748 mm.scr 97 PID 1064 wrote to memory of 376 1064 mm.scr 98 PID 1064 wrote to memory of 376 1064 mm.scr 98 PID 376 wrote to memory of 3176 376 mm.scr 99 PID 376 wrote to memory of 3176 376 mm.scr 99 PID 3176 wrote to memory of 32 3176 mm.scr 100 PID 3176 wrote to memory of 32 3176 mm.scr 100 PID 32 wrote to memory of 4680 32 mm.scr 101 PID 32 wrote to memory of 4680 32 mm.scr 101 PID 4680 wrote to memory of 4628 4680 mm.scr 102 PID 4680 wrote to memory of 4628 4680 mm.scr 102 PID 4628 wrote to memory of 3572 4628 mm.scr 144 PID 4628 wrote to memory of 3572 4628 mm.scr 144 PID 3572 wrote to memory of 3144 3572 mm.scr 104 PID 3572 wrote to memory of 3144 3572 mm.scr 104 PID 3144 wrote to memory of 4792 3144 mm.scr 105 PID 3144 wrote to memory of 4792 3144 mm.scr 105 PID 4792 wrote to memory of 4488 4792 mm.scr 106 PID 4792 wrote to memory of 4488 4792 mm.scr 106 PID 4488 wrote to memory of 936 4488 mm.scr 107 PID 4488 wrote to memory of 936 4488 mm.scr 107 PID 936 wrote to memory of 2292 936 mm.scr 108 PID 936 wrote to memory of 2292 936 mm.scr 108 PID 2292 wrote to memory of 3436 2292 mm.scr 109 PID 2292 wrote to memory of 3436 2292 mm.scr 109 PID 3436 wrote to memory of 3848 3436 mm.scr 110 PID 3436 wrote to memory of 3848 3436 mm.scr 110 PID 3848 wrote to memory of 1088 3848 mm.scr 111 PID 3848 wrote to memory of 1088 3848 mm.scr 111 PID 1088 wrote to memory of 3484 1088 mm.scr 112 PID 1088 wrote to memory of 3484 1088 mm.scr 112 PID 3484 wrote to memory of 4300 3484 mm.scr 113 PID 3484 wrote to memory of 4300 3484 mm.scr 113 PID 4300 wrote to memory of 4696 4300 mm.scr 114 PID 4300 wrote to memory of 4696 4300 mm.scr 114 PID 4696 wrote to memory of 1504 4696 mm.scr 115 PID 4696 wrote to memory of 1504 4696 mm.scr 115 PID 1504 wrote to memory of 468 1504 mm.scr 116 PID 1504 wrote to memory of 468 1504 mm.scr 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f117d1405dc44218e7c22f108a5d8b2e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\mm.scr"C:\Users\Admin\AppData\Local\Temp\mm.scr" /S2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:836 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:408 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:736 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:916 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr66⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr67⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr68⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr69⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr70⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr71⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr72⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr73⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr74⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr75⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr76⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr77⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr78⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr79⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr80⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr81⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr82⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr83⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr84⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr85⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr86⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr87⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr88⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr89⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr90⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr91⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr92⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr93⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr94⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr95⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr96⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr97⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr98⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr99⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr100⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr101⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr102⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr103⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr104⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr105⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr106⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr107⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr108⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr109⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr110⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr112⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr113⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr114⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr115⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr116⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr117⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr118⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr119⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr120⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr121⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\mm.scrC:\Users\Admin\AppData\Local\Temp\mm.scr122⤵PID:4532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-