Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 02:37
Behavioral task
behavioral1
Sample
fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe
-
Size
130KB
-
MD5
fda298f72a1983e613b35cb3becd6ad3
-
SHA1
624d8e8c2a0967300cd784b426f2458c260c1ec0
-
SHA256
aaefbc297b57228834cc15f2a9369ad46bc6ec9a5de09dab594b04e9f0637769
-
SHA512
bda59edc47edd9cc5ed7e3cf36f47cd6c09155e78071ac35898cfc8257137cfa0df2d3e47a7523bd0d627e2b707134d8fd62033acbc9551e6b2324083a824efe
-
SSDEEP
3072:Yq6jDD70ClF9yU0kT1mNL9j3FRnOatS2OULqLUe2Mnu:Yq6jDD7v79ytk0V9j1ROatCUcu
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe File opened for modification C:\Windows\system32\drivers\etc\hosts msdbgcli.exe -
Deletes itself 1 IoCs
pid Process 2856 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2528 msdbgcli.exe 3064 msdbgcli.exe 2896 msdbgcli.exe 1360 msdbgcli.exe 1972 msdbgcli.exe 2572 msdbgcli.exe 1316 msdbgcli.exe 2060 msdbgcli.exe 2124 msdbgcli.exe 2740 msdbgcli.exe 1616 msdbgcli.exe 2720 msdbgcli.exe 2076 msdbgcli.exe 1424 msdbgcli.exe 2256 msdbgcli.exe 1476 msdbgcli.exe 1512 msdbgcli.exe 568 msdbgcli.exe 2624 msdbgcli.exe 1712 msdbgcli.exe 632 msdbgcli.exe 1156 msdbgcli.exe 1968 msdbgcli.exe 2312 msdbgcli.exe 2936 msdbgcli.exe 1468 msdbgcli.exe 1516 msdbgcli.exe 1880 msdbgcli.exe 2596 msdbgcli.exe 1580 msdbgcli.exe 2536 msdbgcli.exe 1324 msdbgcli.exe 1932 msdbgcli.exe 2032 msdbgcli.exe 2192 msdbgcli.exe 968 msdbgcli.exe 1520 msdbgcli.exe 1668 msdbgcli.exe 1948 msdbgcli.exe 860 msdbgcli.exe 2508 msdbgcli.exe 2348 msdbgcli.exe 2788 msdbgcli.exe 608 msdbgcli.exe 2460 msdbgcli.exe 1696 msdbgcli.exe 892 msdbgcli.exe 1476 msdbgcli.exe 928 msdbgcli.exe 1560 msdbgcli.exe 2956 msdbgcli.exe 2540 msdbgcli.exe 1924 msdbgcli.exe 2040 msdbgcli.exe 1872 msdbgcli.exe 932 msdbgcli.exe 1808 msdbgcli.exe 2988 msdbgcli.exe 3028 msdbgcli.exe 1512 msdbgcli.exe 2096 msdbgcli.exe 920 msdbgcli.exe 2552 msdbgcli.exe 1192 msdbgcli.exe -
Loads dropped DLL 64 IoCs
pid Process 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 2528 msdbgcli.exe 2528 msdbgcli.exe 3064 msdbgcli.exe 3064 msdbgcli.exe 2896 msdbgcli.exe 2896 msdbgcli.exe 1360 msdbgcli.exe 1360 msdbgcli.exe 1972 msdbgcli.exe 1972 msdbgcli.exe 2572 msdbgcli.exe 2572 msdbgcli.exe 1316 msdbgcli.exe 1316 msdbgcli.exe 2060 msdbgcli.exe 2060 msdbgcli.exe 2124 msdbgcli.exe 2124 msdbgcli.exe 2740 msdbgcli.exe 2740 msdbgcli.exe 1616 msdbgcli.exe 1616 msdbgcli.exe 2720 msdbgcli.exe 2720 msdbgcli.exe 2076 msdbgcli.exe 2076 msdbgcli.exe 1424 msdbgcli.exe 1424 msdbgcli.exe 2256 msdbgcli.exe 2256 msdbgcli.exe 1476 msdbgcli.exe 1476 msdbgcli.exe 1512 msdbgcli.exe 1512 msdbgcli.exe 568 msdbgcli.exe 568 msdbgcli.exe 2624 msdbgcli.exe 2624 msdbgcli.exe 1712 msdbgcli.exe 1712 msdbgcli.exe 632 msdbgcli.exe 632 msdbgcli.exe 1156 msdbgcli.exe 1156 msdbgcli.exe 1968 msdbgcli.exe 1968 msdbgcli.exe 2312 msdbgcli.exe 2312 msdbgcli.exe 2936 msdbgcli.exe 2936 msdbgcli.exe 1468 msdbgcli.exe 1468 msdbgcli.exe 1516 msdbgcli.exe 1516 msdbgcli.exe 1880 msdbgcli.exe 1880 msdbgcli.exe 2596 msdbgcli.exe 2596 msdbgcli.exe 1580 msdbgcli.exe 1580 msdbgcli.exe 2536 msdbgcli.exe 2536 msdbgcli.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Debug Client = "msdbgcli.exe" msdbgcli.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File created C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe File opened for modification C:\Windows\SysWOW64\msdbgcli.exe msdbgcli.exe -
resource yara_rule behavioral1/memory/2732-0-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2732-1-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/files/0x000a000000012262-6.dat upx behavioral1/memory/2528-16-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2732-17-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2528-28-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2896-33-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/3064-36-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2896-46-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1972-56-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1360-54-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1972-64-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2572-73-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1316-74-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1316-83-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2060-93-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2124-102-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2740-112-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1616-120-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2720-130-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2076-138-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1424-142-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2256-147-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1512-152-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1476-151-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1512-156-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/568-160-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2624-165-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1712-170-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/632-174-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1156-180-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1968-185-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2312-188-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2936-193-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1468-197-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1516-200-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1880-205-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2596-210-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1580-212-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2536-219-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1324-216-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1324-224-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1932-229-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2032-230-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2032-235-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2192-239-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/968-240-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/968-245-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1520-251-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1668-256-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1948-257-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/1948-263-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2508-266-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/860-270-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2508-276-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2348-281-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/608-287-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2788-286-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/608-292-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/2460-297-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/memory/892-301-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdbgcli.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2528 msdbgcli.exe Token: SeIncBasePriorityPrivilege 3064 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2896 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1360 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1972 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2572 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1316 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2060 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2124 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2740 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1616 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2720 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2076 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1424 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2256 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1476 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1512 msdbgcli.exe Token: SeIncBasePriorityPrivilege 568 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2624 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1712 msdbgcli.exe Token: SeIncBasePriorityPrivilege 632 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1156 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1968 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2312 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2936 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1468 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1516 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1880 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2596 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1580 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2536 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1324 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1932 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2032 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2192 msdbgcli.exe Token: SeIncBasePriorityPrivilege 968 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1520 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1668 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1948 msdbgcli.exe Token: SeIncBasePriorityPrivilege 860 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2508 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2348 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2788 msdbgcli.exe Token: SeIncBasePriorityPrivilege 608 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2460 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1696 msdbgcli.exe Token: SeIncBasePriorityPrivilege 892 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1476 msdbgcli.exe Token: SeIncBasePriorityPrivilege 928 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1560 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2956 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2540 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1924 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2040 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1872 msdbgcli.exe Token: SeIncBasePriorityPrivilege 932 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1808 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2988 msdbgcli.exe Token: SeIncBasePriorityPrivilege 3028 msdbgcli.exe Token: SeIncBasePriorityPrivilege 1512 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2096 msdbgcli.exe Token: SeIncBasePriorityPrivilege 920 msdbgcli.exe Token: SeIncBasePriorityPrivilege 2552 msdbgcli.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2528 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2528 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2528 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2528 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2856 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 31 PID 2732 wrote to memory of 2856 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 31 PID 2732 wrote to memory of 2856 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 31 PID 2732 wrote to memory of 2856 2732 fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3064 2528 msdbgcli.exe 33 PID 2528 wrote to memory of 3064 2528 msdbgcli.exe 33 PID 2528 wrote to memory of 3064 2528 msdbgcli.exe 33 PID 2528 wrote to memory of 3064 2528 msdbgcli.exe 33 PID 2528 wrote to memory of 1660 2528 msdbgcli.exe 34 PID 2528 wrote to memory of 1660 2528 msdbgcli.exe 34 PID 2528 wrote to memory of 1660 2528 msdbgcli.exe 34 PID 2528 wrote to memory of 1660 2528 msdbgcli.exe 34 PID 3064 wrote to memory of 2896 3064 msdbgcli.exe 36 PID 3064 wrote to memory of 2896 3064 msdbgcli.exe 36 PID 3064 wrote to memory of 2896 3064 msdbgcli.exe 36 PID 3064 wrote to memory of 2896 3064 msdbgcli.exe 36 PID 3064 wrote to memory of 564 3064 msdbgcli.exe 37 PID 3064 wrote to memory of 564 3064 msdbgcli.exe 37 PID 3064 wrote to memory of 564 3064 msdbgcli.exe 37 PID 3064 wrote to memory of 564 3064 msdbgcli.exe 37 PID 2896 wrote to memory of 1360 2896 msdbgcli.exe 39 PID 2896 wrote to memory of 1360 2896 msdbgcli.exe 39 PID 2896 wrote to memory of 1360 2896 msdbgcli.exe 39 PID 2896 wrote to memory of 1360 2896 msdbgcli.exe 39 PID 2896 wrote to memory of 1036 2896 msdbgcli.exe 40 PID 2896 wrote to memory of 1036 2896 msdbgcli.exe 40 PID 2896 wrote to memory of 1036 2896 msdbgcli.exe 40 PID 2896 wrote to memory of 1036 2896 msdbgcli.exe 40 PID 1360 wrote to memory of 1972 1360 msdbgcli.exe 74 PID 1360 wrote to memory of 1972 1360 msdbgcli.exe 74 PID 1360 wrote to memory of 1972 1360 msdbgcli.exe 74 PID 1360 wrote to memory of 1972 1360 msdbgcli.exe 74 PID 1360 wrote to memory of 3004 1360 msdbgcli.exe 43 PID 1360 wrote to memory of 3004 1360 msdbgcli.exe 43 PID 1360 wrote to memory of 3004 1360 msdbgcli.exe 43 PID 1360 wrote to memory of 3004 1360 msdbgcli.exe 43 PID 1972 wrote to memory of 2572 1972 msdbgcli.exe 45 PID 1972 wrote to memory of 2572 1972 msdbgcli.exe 45 PID 1972 wrote to memory of 2572 1972 msdbgcli.exe 45 PID 1972 wrote to memory of 2572 1972 msdbgcli.exe 45 PID 1972 wrote to memory of 944 1972 msdbgcli.exe 46 PID 1972 wrote to memory of 944 1972 msdbgcli.exe 46 PID 1972 wrote to memory of 944 1972 msdbgcli.exe 46 PID 1972 wrote to memory of 944 1972 msdbgcli.exe 46 PID 2572 wrote to memory of 1316 2572 msdbgcli.exe 48 PID 2572 wrote to memory of 1316 2572 msdbgcli.exe 48 PID 2572 wrote to memory of 1316 2572 msdbgcli.exe 48 PID 2572 wrote to memory of 1316 2572 msdbgcli.exe 48 PID 2572 wrote to memory of 1544 2572 msdbgcli.exe 49 PID 2572 wrote to memory of 1544 2572 msdbgcli.exe 49 PID 2572 wrote to memory of 1544 2572 msdbgcli.exe 49 PID 2572 wrote to memory of 1544 2572 msdbgcli.exe 49 PID 1316 wrote to memory of 2060 1316 msdbgcli.exe 51 PID 1316 wrote to memory of 2060 1316 msdbgcli.exe 51 PID 1316 wrote to memory of 2060 1316 msdbgcli.exe 51 PID 1316 wrote to memory of 2060 1316 msdbgcli.exe 51 PID 1316 wrote to memory of 1912 1316 msdbgcli.exe 115 PID 1316 wrote to memory of 1912 1316 msdbgcli.exe 115 PID 1316 wrote to memory of 1912 1316 msdbgcli.exe 115 PID 1316 wrote to memory of 1912 1316 msdbgcli.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fda298f72a1983e613b35cb3becd6ad3_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"8⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"9⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"10⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"11⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"12⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1616 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2720 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"16⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"18⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"19⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"20⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"21⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"22⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:632 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"23⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"25⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"26⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"27⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"28⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"29⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"30⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"31⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"32⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"33⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"34⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"35⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"36⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2192 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"37⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"38⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"39⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1668 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"40⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"41⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"42⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2508 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"43⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"44⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"45⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:608 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"46⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2460 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"47⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"48⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"49⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"50⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:928 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"51⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"52⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"53⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2540 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"54⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"55⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"56⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"57⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"58⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"59⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"60⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"61⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"62⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2096 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"63⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"64⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"65⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"66⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"67⤵
- Drops file in Drivers directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"68⤵
- Adds Run key to start application
PID:2264 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"69⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:1520 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"70⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"71⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"72⤵
- Drops file in System32 directory
PID:1844 -
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"73⤵PID:1992
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"74⤵PID:1628
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"75⤵PID:2552
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"76⤵PID:1968
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"77⤵PID:1180
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"78⤵PID:2248
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"79⤵PID:2264
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"80⤵PID:1672
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"81⤵PID:1880
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"82⤵PID:2604
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"83⤵PID:2128
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"84⤵PID:632
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"85⤵PID:2592
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"86⤵PID:2412
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"87⤵PID:2932
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"88⤵PID:1088
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"89⤵PID:1544
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"90⤵PID:3016
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"91⤵PID:3040
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"92⤵PID:2624
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"93⤵PID:2536
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"94⤵PID:2692
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"95⤵PID:844
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"96⤵PID:2252
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"97⤵PID:2936
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"98⤵PID:2116
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"99⤵PID:2092
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"100⤵PID:2988
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"101⤵PID:1808
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"102⤵PID:2288
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"103⤵PID:2612
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"104⤵PID:2188
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"105⤵PID:2392
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"106⤵PID:2984
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"107⤵PID:1208
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"108⤵PID:1492
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"109⤵PID:1564
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"110⤵PID:2156
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"111⤵PID:3032
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"112⤵PID:1588
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"113⤵PID:2112
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"114⤵PID:1916
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"115⤵PID:572
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"116⤵PID:2280
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"117⤵PID:2592
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"118⤵PID:1972
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"119⤵PID:1648
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"120⤵PID:888
-
C:\Windows\SysWOW64\msdbgcli.exe"C:\Windows\system32\msdbgcli.exe"121⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-